Why Does My First MD5 Call Take 30 Seconds? A Java Backend Debugging Tale

Requirement Overview

Two APIs – a query interface and a confirm interface – serve the frontend. The query API returns a data snapshot composed of local data and external calculations; the confirm API sends that snapshot to an external service. Because users may spend a long time between viewing and submitting, the confirm step performs a check to detect data changes and prompts a page refresh if needed.

Diagram of the query and confirm interfaces:

How MD5 Was Integrated

The author introduced MD5 to generate a hash of key attributes from the query result, creating a data‑snapshot value. The confirm API then only needs to send this hash for backend comparison.

MD5 Message‑Digest Algorithm (MD5) is a widely used cryptographic hash function that produces a 128‑bit hash value to ensure data integrity.

Typical usage in code: String md5 = Md5Utils.get(String source); In the project a utility method builds the snapshot hash:

/**
 * Generate data hash
 */
private String generateSnapShotHash(AcceptListQueryWrapResultDTO wrapResultDTO) {
    StringBuilder builder = new StringBuilder();
    for (AcceptListQueryResultDTO item : wrapResultDTO.getAllList()) {
        builder.append(item.getQuotationId())
               .append(item.getOperateType())
               .append(item.getPriceTypeCN());
    }
    return MD5.create().digestHex16(builder.toString());
}

First‑Request Timeout Mystery

After deployment the first request to the query API timed out, while subsequent identical requests returned instantly. The author suspected mock services, gateways, or databases, but all proved normal.

Using the Java diagnostic tool Arthas, the author traced the slow path:

trace --skipJDKMethod false com.jd.universal.inquiry.service.protocol.jsf.AcceptListWebErpServiceImpl queryList

trace --skipJDKMethod false com.jd.universal.inquiry.service.protocol.jsf.AcceptListWebErpServiceImpl generateSnapShotHash

The trace showed that MD5.create() consumed >99.99% of the time on the first call (about 36 seconds), while later calls were sub‑millisecond.

Inspecting the MD5 implementation revealed that its static initializer loads a large set of cryptographic algorithms from the BouncyCastle library, which is the root cause of the one‑time delay.

Resolution

Since the Hutool MD5 wrapper could not disable the heavy initialization, the author replaced it with Google’s lightweight MD5 implementation, rebuilt and redeployed the service, and the first‑request latency disappeared.

Takeaways

Evaluate third‑party libraries carefully, especially their initialization cost.

When a test environment shows an issue, investigate thoroughly before blaming mocks or gateways.

Listen to QA feedback; it can save time and prevent late‑night deployments.